Case C- 553/07, Rotterdam v Rijkeboer

This case concerned a preliminary question from the Dutch Raad van State (Council of State) on the interpretation of Arts 6 and 12 of Directive 95/46.

As is well known, this Directive deals with the protection of individuals with regard to the processing of personal data and on the free movement of such data. It has been a controversial Directive ever since it was first proposed. The crux of this controversy has been that the Community Legislature simply cannot adopt fundamental rights legislation, as it has no legal power to do so. The Court of Justice in Opinion 2/94 confirmed that no Treaty provisions conferred any general power Community institutions to enact rules on fundamental rights.

The present case, however, dealt with the scope rather than then the legal basis of Directive 95/46. As described by Advocate General Ruiz-Jarabo Colomer, the reference was made in “a field of knotty problems, namely, the deletion of personal information held by a local authority which had been disclosed to third parties and the resulting right of access to data relating to the processing of that information”.

Directive 95/46 was transposed into Netherlands law by the Law on the protection of personal data (Wet bescherming persoonsgegevens), and certain laws were adapted in order to take account of the Directive. Such was the case of the Law at issue in the main proceedings: the Law on personal data held by local authorities (Wet gemeentelijke basisadministratie persoonsgegevens ; ‘the Wet GBA’).

Article 103(1) of the Wet GBA provided that, on request, the College must notify a data subject in writing, within four weeks, whether data relating to him from the local-authority personal records had, in the year preceding the request, been disclosed to a purchaser or to a third party.

Mr Rijkeboer had requested the Board of Alderman of Rotterdam (pictured) to notify him of all instances in which data relating to him from the local-authority personal records had, in the two years preceding the request, been disclosed to third parties. He wished to know the identity of those persons and the content of the data disclosed to them. Mr Rijkeboer, who had moved to another municipality, wished to know in particular to whom his former address had been disclosed.

The Board complied with that request only in part by notifying him only of the data relating to the period of one year preceding his request, by application of Art. 103(1) of the Wet GBA.
Mr Rijkeboer appealed. The referring court asked whether the restriction, provided for in Art. 103(1) of the Wet GBA, on the communication of data to one year prior to the relevant request was compatible with Art. 12(a) of Directive 95/46, whether or not read in conjunction with Art. 6(1)(e) of that directive and the principle of proportionality.

The Court of Justice, however, stressed that under the system of judicial cooperation established by Art. 234 EC, it was for the Court of Justice to interpret provisions of Community law, whereas the interpretation of national provisions was a matter for the national courts (see, inter alia,
Case C‑449/06 Gysen [2008]).

The Court of Justice therefore held that “the national court should be understood, essentially, as seeking to determine whether, pursuant to the Directive and, in particular, to Art. 12(a) thereof, an individual’s right of access to information on the recipients or categories of recipient of personal data regarding him and on the content of the data communicated might be limited to a period of one year preceding his request for access.”

Two categories of data
The Court of Justice pointed out that a case such as that of Mr Rijkeboer involved two categories of data.

The first concerned personal data kept by the local authority on a person, such as his name and address, which constituted, in the present case, the basic data. It was apparent from the oral observations submitted by the College and the Netherlands Government that those data might be stored for a long time. They constituted “personal data” within the meaning of Art. 2(a) of the Directive, because they represented information relating to an identified or identifiable natural person (see also
Joined Cases C- 465/00, C 138/01 and C 139/01 Österreichischer Rundfunk and Others [2003]; Case C 101/01-Lindqvist [2003]; and Case C 524/06 Huber [2008]).

The second category concerned information on recipients or categories of recipient to whom those basic data were disclosed and on the content thereof and thus related to the processing of the basic data. In accordance with the national legislation at issue in the main proceedings, that information was stored for only one year.

The Court held that the time-limit on the right of access to information on the recipient or recipients of personal data and on the content of the data disclosed, which was referred to in the main proceedings, thus concerned that second category of data.

Whether time-limit authorised
The Court of Justice subsequently examined whether Art. 12(a) of the Directive authorised such a time-limit.

The Court stressed that the purpose of the Directive was to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and thus to permit the free flow of personal data between Member States.

The Court held that the right to privacy meant that the data subject might be certain that his personal data were processed in a correct and lawful manner, and in particular, that the basic data regarding him were accurate and that they were disclosed to authorised recipients.

The Court held that In order to carry out the necessary checks, the data subject must have a right of access to the data relating to him which were being processed.

In that regard, Art. 12(a) of the Directive provided for a right of access to basic data and to information on the recipients or categories of recipient to whom the data were disclosed.

According to the Court, that right of access was necessary to enable the data subject to exercise the rights set out in Art. 12(b) and (c) of the Directive, that was to say, where the processing of his data did not comply with the provisions of the Directive, the right to have the controller rectify, erase or block his data, (paragraph (b)), or notify third parties to whom the data had been disclosed of that rectification, erasure or blocking, unless this proved impossible or involved a disproportionate effort (paragraph (c)).

Art. 12(a) of Directive 95/46
The Court held that Article 12(a) of the Directive required Member States to ensure a right of access to information on the recipients or categories of recipient of personal data and on the content of the data disclosed not only in respect of the present but also in respect of the past.

It was for Member States to fix a time-limit for storage of that information and to provide for access to that information which constituted a fair balance between, on the one hand, the interest of the data subject in protecting his privacy, in particular by way of his rights to object and to bring legal proceedings and, on the other, the burden which the obligation to store that information represented for the controller.

Rules limiting the storage of information on the recipients or categories of recipient of personal data and on the content of the data disclosed to a period of one year and correspondingly limiting access to that information, while basic data was stored for a much longer period, did not constitute a fair balance of the interest and obligation at issue, unless it could be showed that longer storage of that information would constitute an excessive burden on the controller. It was, however, for national courts to make those determinations.

Text of Judgment

On Directive 95/46, see also
this article I wrote for the Common Market Law Review in 2005.